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FIG. 3 





DETECTION ATTRIBUTE 


DETECTION 
THRESHOLD 


DETECTION 
TIME 


1 


{Dst=192.168.1.1/32, Protocol=TCP, Port=80} 


500 kbps 


10 sec 


2 


{Dst=1 92. 1 68. 1 .2/32, Protocol=U DP} 


300 kbps 


10 sec 


3 


{Dst=1 92. 168. 1.0/24} 


1 Mbps 


20 sec 
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FIG.6 
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FIG.7 





